Content Addressable Memory (“CAM”) is used in a variety of applications which require fast and efficient searching for data. In general, CAM is a storage device with a dedicated logic for executing a parallel search for a data word. CAM accepts the data word as a parameter and returns zero or more addresses in CAM at which this data word is stored. In this sense, CAM can be thought of as an inverse of a Random Access Memory (RAM) which returns data stored at a specified address. Typically, a CAM module compares the search word to all stored patterns within a single clock cycle.
Ternary Content Addressable Memory (“TCAM”) offers additional flexibility by storing one or more bits of a block data in the so-called “don't care” state. When searching for a specified data word, TCAM returns a match indication for a bit stored in this state irrespective of the value of the corresponding bit in the specified search word. For example, if a TCAM unit stores the value 0X01 at a certain address, where X indicates a “don't care,” the TCAM may unit return this address when the specified search word is 0001 or 0101.
One category of applications which may use CAM includes anti-virus systems and a Network Intrusion Detection system such as one described in U.S. patent application Ser. No. 12/031,130 entitled “Method and Apparatus for Deep Packet Inspection for Network Intrusion Detection,” filed Feb. 14, 2008. This system may be used, for example, to detect patterns in one or more streams of data. Further, a known technique of detecting network intrusion involves software-based pattern recognition employing, for example, the industry standard “snort” rules that are applied to message headers. This intrusion detection methodology may be applied to either incoming or outgoing traffic. As part of analyzing data traffic, a system executing snort rules may similarly compare a data word to a certain pattern.
Other examples of systems using CAM or TCAM modules include routing devices, databases, and data compression systems.